« Volver al listado

CVE-2010-0834

Estado: ModificadaAlta (9.3)—

The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ubuntu — Ubuntu Linux

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0834",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-08-10T12:23:05.850",
  "references": [
    {
      "url": "http://secunia.com/advisories/40889",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/42280",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-968-1",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2015",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/40889",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/42280",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-968-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2015",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package."
    },
    {
      "lang": "es",
      "value": "El paquete base-files anterior a v5.0.0ubuntu7.1 en Ubuntu v9.10 y anterior a v5.0.0ubuntu20.10.04.2 en Ubuntu v10.04 LTS, como los incluidos en portátiles Dell Latitude 2110, no necesitan autenticación para la instalación de paquetes, lo que permite a atacantes con servidores de archivos remotos y \"man-in-the-middle\" (intermediario)  ejecutar código de su elección a través de paquetes manipulados."
    }
  ],
  "lastModified": "2026-06-16T23:16:56.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ubuntu:ubuntu_linux:9.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27C9BF8A-AD42-401F-A8CA-486B6DCD47BB"
            },
            {
              "criteria": "cpe:2.3:o:ubuntu:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3976D70F-3D30-4EFF-9777-C687B293606B"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:dell:latitude_2110_netbook:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "30DE3567-65F0-431D-B12A-B2764BA313FB"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}